← fix library

HIGH MLflow: MLflow tracking UI/API reachable without authentication

Why it matters

An open MLflow server lets strangers list experiments, read artifact paths, and often pull logged models or credentials stored as params.

Fix it — 3 steps

1. Enable MLflow basic auth or put the tracking server behind an authenticating reverse proxy with TLS.
2. Bind the tracking server to 127.0.0.1 if it is only used locally.
3. Block the port at the firewall: `sudo ufw deny 5000`.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:5000/  # should not return the MLflow UI to strangers

References

• https://mlflow.org/docs/latest/auth/index.html